General

  • Target

    BASE64_extracted_at_0x0.exe

  • Size

    210KB

  • Sample

    220404-xmmgpsefgj

  • MD5

    ae974df30c368c1a055ed2fff5f34ad9

  • SHA1

    41ea866b38753a33bfd3c9fd1ee72cfaf5f1815e

  • SHA256

    fd333e8637662f90097f437c12169365323512bd86a2820e8f93e5158f178f17

  • SHA512

    4c73d27152b44d01eaf19500d7e565b4415170eecdb8b440c73f49cc401b6f9acd0c2fd410986fb1f0eb5c7277e5abdb127059935bb84f353e1d4bdfa2855cef

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5009732133:AAFwMXIJpYDoCsKxNrSeGLfpeTo8-WB2wh8/sendDocument

Targets

    • Target

      BASE64_extracted_at_0x0.exe

    • Size

      210KB

    • MD5

      ae974df30c368c1a055ed2fff5f34ad9

    • SHA1

      41ea866b38753a33bfd3c9fd1ee72cfaf5f1815e

    • SHA256

      fd333e8637662f90097f437c12169365323512bd86a2820e8f93e5158f178f17

    • SHA512

      4c73d27152b44d01eaf19500d7e565b4415170eecdb8b440c73f49cc401b6f9acd0c2fd410986fb1f0eb5c7277e5abdb127059935bb84f353e1d4bdfa2855cef

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks